Security audit
Security checks for vulnerabilities and agentic risk
This research assistant needs review because its typesetting tool executes a fresh, unapproved quote and can give misleading assurances about charges after errors.
Avoid paid typesetting until execution uses the quote you approved and errors report uncertain billing accurately. Check account history before retrying a failed request. Only upload research or screenshots you are comfortable sharing with OwlWrite; backend privacy and refund guarantees were not independently verified. Keep the documented HTTPS endpoint and protect the wallet key, especially when using the CLI client. The disclosed promotion and configuration examples are not evidence of hidden collection.
scripts/mcp_server.pyTypesetting executes a newly generated paid quote without binding execution to user approval
Direct invocation can start a billable task without enforced confirmation. Even when the documented workflow is followed, the charged task uses a different quote from the one approved, permitting execution at a changed price without renewed consent.
Sending a bearer key to the intended API is legitimate, so credential-to-network flow alone does not justify the critical rating. However, the client unconditionally attaches that key to a destination controlled by --base or OWL_BASE without validating its scheme or origin, and urllib's default redirect handling can carry the Authorization header to another origin; a manipulated destination or redirect could expose the wallet credential.
headers["Authorization"] = "Bearer " + load_key(key)
req = urllib.request.Request(url, data=body, headers=headers, method=method)
try:
with urllib.request.urlopen(req, timeout=timeout) as r:
return r.status, json.loads(r.read().decode("utf-8"))
except urllib.error.HTTPError as e:
try:
Credential loading, API requests, and optional response archiving are reasonable supporting implementation details for the declared services. However, claim-favorite explicitly reads and uploads a user-selected image of up to 5 MB for a promotional campaign. This is a separate, undeclared capability rather than an academic workflow or ordinary account balance/recharge operation. The upload requires invoking that command; the code does not show automatic screenshot collection. The supplied chunk also does not establish whether the broader advertised academic features are implemented elsewhere.
Most tools align with the declared academic-workflow purpose. However, owl_campaign and owl_claim_favorite introduce an undeclared marketing and engagement-reward workflow, including screenshot submission to /v1/campaign/favorite-claim. In addition, _notices_tip turns gateway notices into agent-facing instructions to pass announcements to the user, reinforced by the MCP server instructions. These are additional user-facing capabilities rather than necessary implementation details of academic services or account recharge. Ordinary document uploads, API authentication, and the local announcement-deduplication file are not independently treated as mismatches. The gateway implementation and advertised literature coverage cannot be verified from this wrapper alone.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
设置界面的 MCP JSON 与 Claude Desktop 结构完全相同（mcpServers.owlwrite，command/args/env 三件套）。
[mcp_servers.owlwrite]
The typesetting tool obtains a quote and immediately submits the paid typesetting request, returning the estimated price only after execution. Consequently, this call provides no opportunity for the agent to show the actual quote and obtain approval between quotation and execution, despite the documented consent requirement. In a paid academic workflow, a routine request to format a paper can therefore trigger spending without approval of the returned price.
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- 老用户（记得注册邮箱）→ 走「验证码登录」，**不用重新注册，余额和历史记录都在**。
**A. 新用户注册**：
1) 发码：`curl -s -X POST https://owl.skillsutra.cn/v1/auth/send-code -H "Content-Type: application/json" -d '{"email":"<用户邮箱>"}'`
返回 `masked`（脱敏邮箱）与 `cooldown_seconds`。**这一步要告诉用户"去看邮箱，15 分钟内有效"**。
2) 让用户把 6 位验证码发给你，再注册：
`curl -s -X POST https://owl.skillsutra.cn/v1/auth/register -H "Content-Type: application/json" -d '{"email":"<邮箱>","code":"<6位码>"}'`
The workflow explicitly uploads the manuscript before presenting the quote and obtaining execution confirmation, without first requiring informed consent to external disclosure. Unpublished research, personal information, or confidential material can therefore leave the user's device even if the user subsequently declines the paid task.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
别从其他站点、镜像或第三方脚本装同名技能。装完先做下面三步自检，再往下配 Key：
1. `curl -s https://owl.skillsutra.cn/v1/meta` → `skill.latest_version` 不低于 `skill.min_supported_version`（以接口返回为准，别背数字）；
2. 同一响应里 `channels.weipu_ready` 决定能不能做检测（`false` 读 `weipu_detail` 转告用户）；
3. 配好 Key 后调 `owl_wallet`，能返回余额即连通。
The instructions send local manuscript files to a cloud service before obtaining a quote, and the alternative transmits manuscript text and author information directly. Although cloud processing is mentioned, there is no required pre-transfer disclosure and consent step, creating a risk of exposing confidential research or personal information before the user approves that disclosure.
The server inserts announcement text into an imperative _notice_tip, while its MCP instructions require the agent to obey that field. This promotes remotely supplied content from task data into behavioral instructions, enabling unsolicited promotional output and potentially broader prompt injection if announcement content is compromised. Announcements are not necessary to fulfill the user's research request, making this an avoidable trust-boundary crossing.
The broad exception handler converts all typesetting failures, including structured server errors, into a timeout response and asserts that no charge occurred without checking billing state. A request may have completed and been charged before its response was lost, so recommending an identical retry can produce duplicate work or additional charges unless the backend independently prevents them. This also hides actionable authentication, billing, and validation failures from the agent.
The installation instructions leave both MCP and HTTP dependencies unversioned, so installations can receive different, unreviewed releases over time. This is a supply-chain and reproducibility weakness rather than evidence that the named packages are malicious; a compromised release could execute in a process with access to service credentials and local documents.
The troubleshooting entry repeats an unpinned dependency-install command, allowing recovery attempts to install whatever release is currently available. This creates the same dependency-integrity weakness during troubleshooting, although no compromised dependency is demonstrated.
The claim_favorite function reads a user-selected local image and uploads its base64-encoded contents to /v1/campaign/favorite-claim for promotional reward review. Collecting proof of a SkillHub favorite is not a necessary implementation detail of literature research, manuscript preparation, academic checks, or the declared balance and recharge functions.